Privacy policy

This translation is provided for your convenience. Only the German version is legally binding.

Privacy Policy

for the FlashyHue online shop (flashyhue.com)
Version: 30 September 2026

1. Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Centropy Lights UG (haftungsbeschränkt)
represented by the managing director Mika Eichhoff
Pappelweg 29, 73614 Schorndorf, Germany
Email: info@flashyhue.com
Phone: +49 178 8997886

We have not appointed a data protection officer, as we are not legally required to do so. If you have any questions about data protection, please contact us directly using the details above.

2. Overview

We process personal data only to the extent necessary to operate our shop, process your orders, communicate with you or – with your consent – for analytics and marketing purposes. Below we explain which data we process, for what purpose, on what legal basis and for how long, and to whom we pass it on. The legal bases are in particular:

  • Art. 6(1)(a) GDPR – consent,
  • Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures,
  • Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. retention under commercial and tax law),
  • Art. 6(1)(f) GDPR – legitimate interests (e.g. secure and stable operation of the shop, fraud prevention, direct marketing to existing customers).

3. Hosting and shop system (Shopify)

Our shop runs on the Shopify e-commerce platform. The provider for merchants in Europe is Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify stores and processes on our behalf the data generated when you visit the shop and place orders (Art. 28 GDPR). This includes technically necessary access data such as IP address, date and time of access, pages visited, browser and device information and referrer URL. This data is required to deliver the shop, ensure its security and prevent misuse (Art. 6(1)(f) GDPR or, where an order is concerned, Art. 6(1)(b) GDPR).

Shopify may also transfer data to affiliated companies, in particular Shopify Inc. in Canada and Shopify Commerce Inc. or service providers in the USA. The EU Commission has adopted an adequacy decision for Canada. Transfers to the USA are based on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information can be found in Shopify's privacy policy: https://www.shopify.com/legal/privacy.

4. Shopify network: Shop, Shop Pay and Shopify Network Intelligence

In addition to processing on our behalf (section 3), Shopify also uses certain data from your visits to and purchases in our shop for its own purposes and may combine it with data from your interactions with other Shopify merchants and with Shopify itself. For this purpose we have enabled the "Shopify Network Intelligence" setting. Shopify uses this data in particular to

  • detect and prevent fraud and misuse and secure the checkout,
  • improve checkout and payment, for example in the selection and order of the payment methods displayed,
  • develop its products and features, their personalisation and store performance.

Other merchants do not get access to your data. For this processing, Shopify (for customers in the EEA: Shopify International Limited, address see section 3) does not act as our processor but as an independent controller or, where applicable, as a joint controller with us; Shopify describes the details in its privacy policy. The legal basis for the transfer to Shopify is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and conversion-optimised checkout. Where cookies or comparable technologies that are not strictly necessary are used for this, or your data is used for advertising (e.g. ads based on your activity with other merchants), this only happens with your consent via the cookie banner (section 10; Section 25(1) TDDDG, Art. 6(1)(a) GDPR). According to Shopify, without your consent this data is not used for such purposes.

Shop and Shop Pay: If you use Shop Pay at checkout or sign in with your Shop account (e.g. via the Shop app or "Sign in with Shop"), Shopify additionally processes your contact, address, payment and order data in your Shop account as an independent controller so that you can pay faster in Shopify stores and track orders. Shopify's terms and privacy policy apply to this.

Further information can be found in Shopify's privacy policy: https://www.shopify.com/legal/privacy. Via Shopify's privacy portal for consumers (https://privacy.shopify.com) you can exercise your rights directly vis-à-vis Shopify, in particular object to processing, withdraw consent or limit the use of your data for advertising purposes. Your right to object under Art. 21 GDPR (section 20) remains unaffected.

5. Orders and contract processing

When you order from us, we process the data you enter at checkout, in particular first and last name, delivery and billing address, email address, telephone number if applicable, company name and VAT ID (for business customers), the items ordered and payment and shipping information. We use this data to conclude and perform the purchase contract, send you order and shipping confirmations, handle returns, withdrawals and warranty claims, and contact you if we have questions. The legal basis is Art. 6(1)(b) GDPR. Mandatory fields are marked at checkout; without this information we cannot conclude the contract.

Once the contract has been fully performed, further processing of your data is restricted and the data is deleted after the statutory retention periods have expired. Commercial and tax law (in particular Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)) requires us to retain invoices, accounting records and business correspondence for six, eight or ten years depending on the type of document. The legal basis for this is Art. 6(1)(c) GDPR.

To comply with our tax obligations (e.g. VAT and OSS returns), we may pass the necessary order and invoice data to our tax adviser or to a VAT compliance service provider engaged by us (Art. 6(1)(c) GDPR).

6. Payment processing

We offer various payment methods at checkout. Depending on the payment method you choose, we pass the data required for payment (e.g. name, address, email address, invoice amount, order number and payment data) to the respective payment service provider (Art. 6(1)(b) GDPR; for fraud prevention also Art. 6(1)(f) GDPR). We do not store card data; it is processed directly by the payment service provider. Some payment service providers act as independent controllers, in which case their privacy policies also apply. These include in particular:

  • Shopify Payments (credit and debit cards, Apple Pay, Google Pay and other payment methods offered there) – Shopify and the payment service providers used by Shopify;
  • Shop Pay – Shopify; if you use Shop Pay, your data is also stored in your Shop Pay account;
  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg;
  • Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For purchases on invoice or in instalments, Klarna may carry out an identity and credit check; for details please refer to Klarna's privacy notice;
  • local payment methods such as EPS, iDEAL | Wero, Bancontact, BLIK, MB Way or MobilePay, where offered at checkout – the respective providers or banks.

You can see which payment methods are available in each case at checkout.

7. Shipping

To deliver your order, we pass your name and delivery address to the shipping company we use, usually Deutsche Post AG or DHL (Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany). The legal basis is Art. 6(1)(b) GDPR. We only pass your email address or phone number to the shipping company if this is necessary for delivery or if you have consented (e.g. for a delivery notification).

8. Contact by email, phone or contact form

If you contact us by email, by phone or via the contact form on our website, we process your details (e.g. name, email address, phone number and the content of your message) in order to answer your enquiry. If the enquiry relates to a contract or an order, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The contact form is provided via a form app integrated into Shopify, which processes your input on our behalf and forwards it to us. We delete your enquiry once it has been dealt with in full, unless statutory retention obligations apply.

9. Customer account

You can optionally create a customer account; you can also order without an account. In the customer account we store your contact details, addresses and order history so that you can complete future orders faster and view previous orders (Art. 6(1)(b) GDPR). You can have your customer account deleted at any time; a message to info@flashyhue.com is sufficient. Data that we must retain for legal reasons will be blocked until the retention periods expire.

10. Cookies and similar technologies, consent banner

Our shop uses cookies and similar technologies (e.g. local storage). Storing information on your device and accessing it is permitted without consent under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) if it is strictly necessary to provide the service you have requested – for example for the shopping cart, checkout, language settings, security functions and to store your cookie choice. We base the subsequent processing of personal data in this respect on Art. 6(1)(b) or (f) GDPR.

We only use all other cookies and technologies, in particular for statistics, personalisation and marketing, with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We obtain consent via Shopify's cookie banner, which is displayed on your first visit. Your choice is passed on to the integrated services via Shopify's Customer Privacy API so that they only become active in accordance with your choice. You can withdraw or change your consent at any time with effect for the future by reopening the cookie settings (link "Cookie settings" or "Privacy settings" in the shop, where displayed) or by deleting the cookies in your browser.

11. Web analytics with Shopify Analytics

Shopify provides us with statistics on the use of the shop (e.g. page views, visitor origin, time spent, shopping carts and purchases). Where cookies or comparable technologies that are not strictly necessary are used for this purpose, this only happens with your consent via the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Shopify processes this data on our behalf.

12. Marketing: Meta (Facebook & Instagram) and TikTok

We use the "Facebook & Instagram" and "TikTok" sales channels in Shopify. If you have consented to marketing in the cookie banner, the Meta Pixel or the TikTok Pixel is loaded. These record events in our shop (e.g. page views, adding items to the cart, purchases) together with device and browser information and your IP address and transmit them to the respective provider. This allows us to measure the effectiveness of our advertising and show ads to people who are interested in our products (including audiences based on shop visitors). The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without consent, these pixels are not activated.

  • Meta: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for the collection and transmission of the data (Art. 26 GDPR); Meta is solely responsible for further processing. Transfers to Meta Platforms, Inc. in the USA are based on the EU-US Data Privacy Framework or Standard Contractual Clauses. Privacy policy: https://www.facebook.com/privacy/policy.
  • TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Data may also be transferred to TikTok group companies outside the EU; according to TikTok, such transfers are based on Standard Contractual Clauses. Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

We also sell products via the Shopify channels Shop, Facebook & Instagram and TikTok. If you shop there or interact with our profiles, the privacy policies of the respective platform also apply.

13. Affiliate and referral programme (BixGrow)

For our affiliate and referral programme we use the Shopify app BixGrow (BixGrow, 3 Coleman Street, #03-24, Peninsula Shopping Complex, Singapore 179804). If you come to us via a partner link or a partner discount code and place an order, the order (order number, order value, link or code used, time) is attributed to the respective partner so that we can settle the commission. Where information is stored on or read from your device for this purpose (e.g. a referral cookie), this only happens with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); attribution via an entered discount code is based on our legitimate interest in correct commission settlement (Art. 6(1)(f) GDPR). Partners do not receive buyers' contact details. If you take part in the partner programme yourself, we process your details (e.g. name, email address, payout details) to run the programme (Art. 6(1)(b) GDPR). Singapore does not have an adequacy decision from the EU Commission; transfers therefore only take place on the basis of appropriate safeguards such as Standard Contractual Clauses (Art. 46 GDPR).

14. Wholesale via Faire

Business customers (retailers) can also order our products via the wholesale platform Faire (Faire Wholesale, Inc., San Francisco, USA). For such orders, we receive from Faire the data required for processing (e.g. company name, contact person, delivery and billing address, order data) and process it to perform the contract (Art. 6(1)(b) GDPR). Faire is itself responsible for the use of the platform; Faire's privacy policy applies.

15. Newsletter (Shopify Email)

You can subscribe to our newsletter on our website to receive news about colours, products and promotions. For this we need your email address. We use the double opt-in procedure: after signing up, you will receive an email in which you must confirm your subscription. Only then will we send you the newsletter. We log the sign-up and confirmation (time, IP address) in order to be able to prove consent. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) of the German Unfair Competition Act (UWG)); logging is based on Art. 6(1)(c) and (f) GDPR.

The newsletter is sent via Shopify Email (Shopify, see section 3). It may be analysed whether a newsletter was opened and which links were clicked in order to improve the newsletter. You can unsubscribe at any time – via the unsubscribe link in every email or by sending a message to info@flashyhue.com. Your email address will then be removed from the mailing list; to prove consent given previously, we may keep it on a block list for up to three years (Art. 6(1)(f) GDPR).

If you have purchased goods from us and provided your email address, we may send you information about our own similar products even without separate consent (Section 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this at any time without incurring any costs other than the transmission costs at the basic rates.

16. Fonts, scripts and videos from third-party providers

For consistent display and for certain functions, we integrate content from external providers. For technical reasons, your IP address is transmitted to the respective provider:

  • Google Fonts – the "Space Grotesk" font, loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (a transfer to Google LLC in the USA cannot be ruled out; basis: EU-US Data Privacy Framework);
  • jsDelivr – content delivery network for a smooth-scrolling script, operated via servers of CDN partners distributed worldwide;
  • YouTube – on the homepage we show a preview image from YouTube (Google Ireland Limited). The video itself is only loaded when you click on it, and then in privacy-enhanced mode (youtube-nocookie.com).

The legal basis is our legitimate interest in an attractive and functional presentation of our shop (Art. 6(1)(f) GDPR); when playing the video, additionally your action of actively requesting the video.

17. Links to social networks

We refer to our profiles on Instagram and TikTok only with simple links. Merely visiting our shop does not transmit any data to these networks. Only when you click a link are you taken to the respective provider's page, to which its privacy policy applies.

18. Recipients and transfers to third countries

We only pass on your data to the recipients named in this policy, i.e. to processors (in particular Shopify and the apps mentioned), to Shopify as an independent controller (section 4), to payment service providers and shipping companies to perform the contract, to tax advisers or authorities where we are legally obliged to do so, and, with your consent, to advertising partners. We do not sell your data. Transfers to countries outside the EU or EEA only take place if there is an adequacy decision by the EU Commission (e.g. the EU-US Data Privacy Framework for certified US companies) or appropriate safeguards such as Standard Contractual Clauses, or if you have expressly consented.

19. Storage period

We only store personal data for as long as is necessary for the respective purpose or as long as statutory retention obligations apply. Details can be found under the respective processing activities. The storage period of cookies depends on your choice in the cookie banner and the respective cookie lifetime; you can delete cookies in your browser at any time.

20. Your rights

Under the GDPR you have the following rights vis-à-vis us:

  • access to the data stored about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR), unless legal obligations prevent this,
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • objection to processing (Art. 21 GDPR, see below).

Right to object: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons; we will then no longer process your data for this purpose.

Withdrawal of consent: You can withdraw any consent you have given at any time with effect for the future, e.g. via the cookie settings, the unsubscribe link in the newsletter or by email to info@flashyhue.com. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, simply send a message to info@flashyhue.com or to our postal address.

21. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany
Postfach 10 29 32, 70025 Stuttgart
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

22. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. If a payment service provider (e.g. Klarna for purchases on invoice or in instalments) carries out an automated credit check under its own responsibility, it will inform you of this in its privacy notice.

23. Data security

Our shop is delivered exclusively via an encrypted connection (HTTPS/TLS). We and our service providers take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.

24. Changes to this privacy policy

We will adapt this privacy policy if our offer, the services used or the legal situation change. The current version published here applies.